OCC Finalizes GENIUS Act Rulemaking

On October 21, 2026, the Office of the Comptroller of the Currency (“OCC”) issued a final rule implementing the Guiding and Establishing National Innovation for US Stablecoins Act (the “GENIUS Act”) for payment stablecoin activities under its jurisdiction (the “Final Rule”). The Final Rule largely retains the framework from the OCC’s proposal announced on February 25, 2026 (the “Proposal”), discussed in our previous Legal Update, but changes the reserve, redemption, and capital requirements in important respects. The Final Rule takes effect on January 18, 2027.

This Legal Update reviews key features of the Final Rule, following the structure of new 12 C.F.R. Part 15, with a focus on the principal changes from the Proposal and their implications for US and non-US issuers.

I. Background

The GENIUS Act, signed into law on July 18, 2025, establishes a federal regulatory framework for payment stablecoins and restricts their issuance to permitted payment stablecoin issuers (“PPSIs”). The GENIUS Act creates three pathways to become a PPSI:

• A subsidiary of an insured depository institution (“IDI”) approved by its primary federal regulator;
• A “Federal qualified payment stablecoin issuer” (“FQPSI”) approved by the OCC; and
• A “State qualified payment stablecoin issuer” (“SQPSI”) approved by a state regulator.

The GENIUS Act also provides a registration pathway for foreign payment stablecoin issuers (“FPSIs”) whose stablecoins circulate among US persons.

The GENIUS Act defines a “payment stablecoin” as a digital asset that is, or is designed to be, used as a means of payment or settlement, and whose issuer is obligated to convert, redeem, or repurchase it for a fixed amount of monetary value, and represents that it will maintain (or creates the reasonable expectation that it will maintain) a stable value relative to a fixed amount of monetary value.¹

Implementation of the GENIUS Act remains a multi-agency effort. The Board of Governors of the Federal Reserve System (“Federal Reserve”), the Federal Deposit Insurance Corporation (“FDIC”), and the National Credit Union Administration (“NCUA”) have proposed rules for the issuers they supervise. The Department of the Treasury has proposed principles for state regulatory regimes and rules governing stablecoin issuance, offers, and sales. The Treasury-led Stablecoin Certification Review Committee has adopted interim procedures for state certifications. The Financial Crimes Enforcement Network (“FinCEN”) and Office of Foreign Assets Control have proposed anti-money laundering (“AML”) and sanctions standards, and FinCEN and the banking agencies have proposed customer identification requirements. Much of that work remains at the proposal stage.

II. New 12 C.F.R. Part 15

Our earlier Legal Update discusses the Proposal in detail. In brief, the Proposal would have created a new 12 C.F.R. Part 15 and amended 12 C.F.R. Parts 3, 6, 8, and 19 to establish a framework for OCC-supervised issuers covering licensing, reserves, prudential standards, custody, capital, reporting, supervisory fees, and enforcement.

Among other things, the Proposal would have limited PPSIs to issuing and redeeming payment stablecoins, managing reserves, providing related custody services, and activities that directly support those functions. It would have implemented the statutory ban on paying interest or yield, backed by a rebuttable presumption covering certain affiliate and third-party arrangements. It also would have required 1:1 reserves measured at fair value, offered two alternative approaches to reserve diversification, and generally required redemption within two business days. Finally, it would have imposed weekly, monthly, and quarterly reporting, individualized capital requirements subject to a $5 million floor during a three-year de novo period, and an operational backstop of liquid assets equal to 12 months of expenses.

Below we focus on material changes and clarifications in the Final Rule.

Scope, Preemption, and Definitions (Subpart A, §§ 15.1-15.4)

Scope

Like the Proposal, Part 15 applies to the payment stablecoin activities and certain custody activities of national banks, federal savings associations, and federal branches, and their subsidiaries; FPSIs; nonbank entities that seek to be, or are approved as, FQPSIs; and SQPSIs over which the OCC has regulatory or enforcement authority. The OCC explained that entities outside these categories are not captured by the rule. In response to commenters concerned about sweeping in technology and infrastructure providers, the OCC stated that a blockchain infrastructure or technology service provider is covered only if it issues a payment stablecoin and is a type of entity subject to the OCC’s jurisdiction.

Preemption

The GENIUS Act has several provisions that preempt state licensing, chartering, and authorization requirements for payment stablecoin issuers. The Proposal did not include provisions to implement these provisions of the GENIUS Act. The OCC explained that including preemption provisions in the rule itself was unnecessary because the statutory provisions are self-executing. Some commenters asked the OCC to add provisions to the Final Rule that would elaborate on and clarify the scope of preemption.

The OCC declined these requests and did not add preemption provisions to Part 15, concluding that the issues raised either did not require regulatory changes, fell outside the scope of the rulemaking, or were better evaluated case by case. According to the OCC, because the preemption and visitation framework is self-executing, no rule text is needed, and the agency should retain flexibility to address interpretive questions as they arise.

Payment Stablecoin Holders Are Not Customers

The Proposal would have defined “customer” broadly as any person that purchases the products or services of another person, which could have captured holders with only an indirect relationship to the issuer, such as a beneficial owner who acquired a stablecoin in the secondary market and never dealt directly with the issuer.

Several commenters argued that the definition was overly broad and made certain customer notification requirements impractical, and urged the OCC to require a direct relationship, such as a contractual one, between the issuer and its customers. Others favored a broad definition that would reach secondary-market holders.

The Final Rule distinguishes a “payment stablecoin holder,” defined as the beneficial owner of a payment stablecoin, from a “customer,” which now means a person that purchases the issuer’s products or services directly from the issuer or asks the issuer directly to redeem a payment stablecoin. As a result, a holder that acquired a stablecoin from a third-party distributor (including a white-label partner) that did not act as the issuer’s agent would not become a customer unless and until it seeks redemption from, or purchases products or services directly from, the issuer. The OCC explained that the narrower definition is intended to produce a set of customers that issuers can readily identify.

This distinction matters because Part 15 assigns different obligations to the two groups. Customer-based requirements, such as notifications of unauthorized access to sensitive customer information, now generally extend only to persons with a direct relationship with the issuer, which should ease compliance. By contrast, redemption disclosures must be readily noticeable and understandable to all payment stablecoin holders, and the OCC explained that the “holder” definition is important to implementing the yield prohibition. The OCC noted that neither definition affects the meaning of “customer” under other laws, including privacy laws and the Bank Secrecy Act (“BSA”).

Insured Depository Institutions and US Branches of Foreign Banks

The definition of “insured depository institution” matters because, under the GENIUS Act, deposits count as reserve assets only if they are held at an IDI. The definition also determines which banks may issue payment stablecoins through the IDI-subsidiary pathway. The GENIUS Act defines the term by cross-reference to the Federal Deposit Insurance Act and includes insured credit unions.

The Proposal would have defined the term to incorporate the general definition in 12 U.S.C. 1813(c)(2), meaning a bank or savings association whose deposits are insured by the FDIC, along with insured credit unions.
Commenters urged the OCC to use the broader definition in 12 U.S.C. 1813(c)(3), which also treats uninsured branches and agencies of foreign banks, and commercial lending companies owned or controlled by foreign banks, as IDIs in certain circumstances. Under that approach, demand deposits at certain offices of a foreign bank could have counted as reserve assets.

The OCC declined and adopted the definition as proposed. The OCC explained that section 1813(c)(3) treats these foreign bank offices as IDIs only for purposes of the enforcement provisions in 12 U.S.C. 1818. In the OCC’s view, because that limited-purpose definition is clearly confined to section 1818, extending it to the GENIUS Act would not be a permissible interpretation, and a plain reading of the Act excludes uninsured branches and agencies of foreign banks.

Accordingly, demand deposits at these offices of a foreign bank do not qualify as reserve assets under 12 U.S.C. 5903(a)(1)(A)(ii), although an eligible branch or agency may hold reserve assets in custody under separate rules.

Permitted and Prohibited Activities (Subpart B, § 15.10)

These provisions define the boundaries of a PPSI’s business. The GENIUS Act provides that a PPSI “may only” issue and redeem payment stablecoins, manage related reserves, provide custodial or safekeeping services for payment stablecoins, reserves, and private keys, and undertake other activities that directly support those activities. The Final Rule implements this limitation in § 15.10(a), which clarifies that the list of permitted activities is exclusive.

Permitted Activities

The Final Rule retains the Proposal’s basic list of permissible activities, including issuance, redemption, reserve management, related custody, and directly supporting activities, while adding several new permitted activities.

The Final Rule adds three new enumerated activities. First, issuers may hold non-payment stablecoin digital assets as principal as necessary to pay fees, including customer and network (“gas”) fees, or to conduct necessary testing on distributed ledger platforms, in quantities not exceeding those necessary for the reasonably foreseeable conduct of these activities. The Proposal had described these holdings as an example of a permissible directly supporting activity, but commenters asked the OCC to recognize them expressly, and the OCC agreed that paying network fees may be necessary to operate on certain blockchains. The OCC declined to set a quantitative cap, and these assets may not be commingled with or counted as reserve assets.

Second, issuers may establish a trust arrangement for reserve assets, including by granting a trustee a security interest. The arrangement must be solely for holders’ benefit, may not impair timely redemption before default or introduce claims competing with holders in insolvency, and may not impair a receiver’s ability to promptly transfer or liquidate reserves. These collateral trustee structures, which are new in the Final Rule, can give holders an added layer of protection in an issuer insolvency, and the OCC stated that it is considering a separate rulemaking to provide further clarity.

Third, issuers may manage foreign exchange risk, subject to new risk management requirements discussed below. This addition, which commenters requested, is significant because it confirms that issuers may offer non-US-dollar payment stablecoins backed by the generally US-dollar-based reserve asset list.

The OCC also clarified that the catch-all for directly supporting activities includes hiring third parties, such as investment advisers or asset managers for reserve assets, although the issuer remains responsible for compliance. The OCC explained that the “directly support” standard does not limit issuers to activities that are strictly necessary, and it encouraged issuers to ask the OCC directly whether a particular activity is permissible.

The GENIUS Act’s rule of construction preserves a PPSI’s ability to conduct specified payment stablecoin and digital asset service provider activities, and incidental activities, when authorized by its regulator and consistent with other federal and state laws. Digital asset service provider activities include engaging, for compensation or profit, in the business of exchanging digital assets for monetary value or other digital assets, transferring them to third parties, providing custody, or participating in financial services relating to their issuance. Unlike the Proposal, which addressed the issue only in the preamble, new § 15.10(b)(2) expressly confirms that Part 15 does not limit activities consistent with this rule of construction that are independently authorized under other applicable law. The OCC declined to create a separate approval process and instead encouraged issuers to ask it directly whether specific activities are permissible.

The Proposal requested comment on whether to limit each PPSI to a single stablecoin brand, with a streamlined approval process for affiliated issuers of additional brands, to address reserve uncertainty and contagion risk in white-label arrangements. According to the OCC, the vast majority of commenters stated that such a limit would increase regulatory burden, although some agreed that it could help mitigate contagion risk and protect holders in insolvency.

The OCC declined to impose a one-brand limit, noting that such a limit is not clearly mandated by the statute, and declined to require separate reserves for each brand. Instead, the OCC will evaluate case by case during licensing or registration whether holders are adequately protected when an issuer issues multiple brands.

The OCC explained, however, that this flexibility does not eliminate issuer-level licensing. A sponsor that houses each brand in a separate special purpose vehicle (“SPV”) must obtain a separate PPSI license for each SPV, although the OCC anticipates that later SPV applications can leverage earlier ones and that an SPV may rely on its parent’s risk management framework. Reserve reports must identify brands and describe the legal and operational separation of any distinct reserve pools.

Interest and Yield Prohibition

The GENIUS Act prohibits PPSIs and FPSIs from paying the holder of a payment stablecoin “any form of interest or yield (whether in cash, tokens, or other consideration) solely in connection with the holding, use, or retention” of the stablecoin. The Final Rule implements this prohibition for PPSIs in § 15.10(c)(4) and applies a parallel prohibition to FPSIs in § 15.31(c).

The Proposal would have supplemented the prohibition with a rebuttable presumption. An issuer would have been presumed to pay prohibited interest or yield if it had an arrangement to pay interest or yield to an affiliate or a “related third party” (such as a white-label partner or a person offering yield to holders as a service), and that person had an arrangement to pay interest or yield to holders of the issuer’s stablecoins.

The presumption drew extensive and sharply divided comment. Ultimately, the OCC decided not to finalize the presumption. The OCC explained that, because payment stablecoins are a nascent market, a presumption would be inappropriate at this time. According to the OCC, the presumption could have been both overinclusive, capturing permissible arrangements, and underinclusive, implying that arrangements outside its scope are permissible, while requiring arrangements to go through the rebuttal process risked imposing burden without a commensurate benefit.

The OCC emphasized, however, that it retains its authority to address evasion of section 4 of the GENIUS Act, including the yield prohibition. The OCC also declined to adopt a general safe harbor, including for white-label or rewards programs, or a de minimis exception. Instead, the OCC stated that it will monitor arrangements through applications and ongoing supervision, take action and provide public guidance where it identifies violations or evasion, and may eventually propose a rule clarifying the prohibition.

Reserve Assets (Subpart B, § 15.11)

The GENIUS Act requires a PPSI to maintain identifiable reserves backing its outstanding payment stablecoins on at least a 1:1 basis, and limits those reserves to a list of high-quality, liquid assets. It also requires the OCC and other regulators to adopt liquidity, reserve asset diversification, and interest rate risk management standards tailored to issuers’ business models and risk profiles.

At a high level, the Proposal would have implemented these requirements by requiring 1:1 reserves measured at fair value, specifying the eligible reserve assets, and offering two alternative approaches to diversification and concentration, as discussed below. It also would have required large issuers to hold a minimum amount of insured deposits and imposed automatic consequences for reserve shortfalls. Our earlier Legal Update discusses these provisions in more detail.

Reserve Ratio Requirement

The Proposal’s 1:1 reserve ratio requirement remains in the Final Rule, meaning that issuers must maintain identifiable, segregated reserves that cover outstanding stablecoins at all times. Under the Final Rule, “reserve asset value” counts US coins and currency at face value and other reserves at fair value, net of associated liabilities (to avoid double counting repurchase transactions). Outstanding issuance remains measured at par.

Eligible Reserve Asset List

The GENIUS Act specifies the assets that may serve as reserves. At a high level, they include US coins and currency and Federal Reserve balances; demand deposits or insured shares at IDIs; Treasury securities with a remaining maturity, or issued with a maturity, of 93 days or less; certain overnight repos and reverse repos involving Treasury securities; registered government money market funds invested solely in these assets; other similarly liquid federal government-issued assets approved by the regulator; and tokenized forms of certain of these assets.

The Proposal largely mirrored the statutory list. It also would have clarified that intraday repos and reverse repos qualify, that a money market fund holding Treasury securities with remaining maturities longer than 93 days would not qualify, and that neither stablecoins nor other crypto-assets qualify as reserve assets.

The eligible reserve asset list is largely unchanged in the Final Rule. The OCC clarifies that deposits must be payable on demand without conditions or delays and that an exchange-traded fund may qualify if its underlying assets meet the rule’s requirements. A tokenized reserve asset must have an authoritative distributed-ledger record and convey the same legal rights as its non-tokenized counterpart.

Reserve Diversification

The GENIUS Act directs the OCC to issue regulations implementing reserve asset diversification standards, including deposit concentration at banking institutions, and interest rate risk management standards. Those standards must be tailored to issuers’ business models and risk profiles and may not exceed what is sufficient to ensure issuers’ ongoing operations. The Act does not itself prescribe specific diversification limits.

The Proposal offered two alternatives. Option A would have required reserves to be diversified in a manner tailored to the issuer’s business model and risk profile, with an optional quantitative safe harbor, while Option B would have made the quantitative standards mandatory.

The Final Rule adopts a hybrid approach that keeps the principles-based diversification standard with fewer quantitative requirements. Issuers must manage portfolio risk and hold at least 5% of reserves in qualifying on-demand deposits or share accounts or Federal Reserve balances, rather than the proposed 10%. A 40% single-counterparty exposure limit remains, with exclusions for US government exposures, qualifying custodial exposures, and centrally cleared repos and reverse repos.

Weekly Liquidity Minimum

Under the Proposal’s Option A safe harbor (and as a mandatory requirement under Option B), a PPSI would have had to hold at least 30% of its reserve assets in demand deposits, Federal Reserve balances, or amounts receivable and due unconditionally within five business days. The OCC explained that this weekly liquidity minimum was designed to protect issuers against redemption runs that unfold over multiple days and to prevent issuers from meeting the daily liquidity requirement while otherwise holding less readily monetizable assets.

Comments on the weekly minimum were mixed, and the OCC did not finalize the 30% weekly liquidity minimum. It also dropped the proposed 20-day weighted-average-maturity limit, the rule limiting one institution to 50% of required daily liquidity, and the proposed requirement that issuers with at least $25 billion outstanding hold 0.5% of reserves in insured deposits or shares, up to $500 million. The OCC explained that it substantially reduced these quantitative requirements and instead imposed stress testing and reserve buffer requirements, which it believes will keep reserve portfolios sufficiently liquid.

New Issuance During a Reserve Shortfall

Under the Proposal, an issuer whose reserves fell below the required 1:1 level would have been required to notify the OCC and would have been immediately prohibited from issuing new payment stablecoins until it remedied the shortfall, except as needed to move stablecoins between distributed ledgers without increasing net issuance. If the shortfall persisted for 15 consecutive business days, the issuer would have been required to begin liquidating reserves and redeeming all outstanding stablecoins, without charging redemption fees. The OCC could have extended the 15-day period in its discretion, required a remediation plan, or ordered redemption of all outstanding stablecoins.

The Final Rule largely retains the Proposal’s approach, including the 15-day liquidation trigger and the OCC’s discretion to extend it. In response to comments, however, the Final Rule provides that the OCC may permit an under-reserved issuer to continue issuing new payment stablecoins. The OCC explained that this change provides flexibility where continued issuance may be appropriate while keeping the issuer subject to scrutiny. The OCC declined to eliminate the automatic liquidation trigger, emphasizing the importance of maintaining required reserves at all times and noting its discretion to extend the period.

The OCC also rejected the request for an intraday exception. The OCC stated in the preamble that the 1:1 reserve requirement applies at all times and does not allow for shortfalls. As a result, even a temporary intraday shortfall caused by settlement timing would trigger the Final Rule’s notice requirement and the prohibition on new issuance, unless the OCC permits otherwise.

Pass-Through Deposit Insurance

Reserve assets may include demand deposits at IDIs, which raises the question whether payment stablecoin holders could obtain FDIC pass-through coverage on those deposits. The Proposal did not address this. Pass-through coverage would give holders some protection if the IDI holding an issuer’s reserves failed. It would not, however, insure the issuer’s own obligation represented by the payment stablecoin, because the issuer is not an insured institution.

The Final Rule does not include provisions addressing pass-through insurance for reserve deposits. The OCC declined to address the issue because the FDIC has addressed it in a separate proposal that has not been finalized. Under that proposal, the FDIC would insure reserve deposits as corporate deposits of the PPSI rather than on a pass-through basis to individual holders. The OCC stated that it will consider whether revisions to Part 15 are necessary once the FDIC finalizes its rule.

The Final Rule does, however, add new disclosure requirements. It requires an issuer’s redemption disclosures to state that payment stablecoins are not deposits, are not backed by the full faith and credit of the United States, and are not subject to FDIC deposit insurance or NCUA share insurance. It also requires disclosure that payment stablecoins are not legal tender and are not issued, guaranteed, or approved by the United States. The OCC explained that these disclosures align with the GENIUS Act’s prohibitions on misrepresenting insured status and on deceptive names, and that their benefit to holders outweighs the minimal burden.

Redemption (Subpart B, § 15.12)

The GENIUS Act requires a PPSI to publicly disclose a redemption policy that establishes clear and conspicuous procedures for timely redemption, and to disclose all purchase and redemption fees, which may be changed only on at least seven days’ prior notice. The Act does not, however, define “timely” or set a minimum redemption period.

The Proposal would have required each issuer’s redemption policy to include, among other things, its redemption timeframes, instructions for redeeming, and any minimum redemption amount, which could be no greater than one stablecoin. The Proposal would have defined “timely” redemption as no later than two business days after the requested redemption. The OCC described this as an outer limit and explained that it would give holders sufficient responsiveness while allowing issuers to manage liquidity.

The Final Rule retains the two-business-day standard but adds a new provision specifying when the period begins and ends. Under the Final Rule, the redemption obligation begins when the issuer receives a redemption order and, if the issuer’s onboarding procedures are reasonably designed not to unduly delay onboarding (including in times of stress), the customer has been onboarded and other legal conditions are met. Redemption is deemed to occur when the issuer fully processes and initiates the outgoing transfer or, at the customer’s request, credits an account with the issuer. As a result, the issuer need not wait for the customer’s bank to receive the funds.

The OCC explained that this approach focuses on actions within the issuer’s control, addresses complications in cross-border transactions and redemptions by new customers, avoids conflicts with BSA and sanctions obligations, and aligns with market practice. The onboarding condition is designed to prevent an issuer from using deficient onboarding as a pretext to extend the redemption timeline.

In the preamble, the OCC stated its interpretation that issuers must have the legal obligation to redeem from any holder, including a retail holder seeking to redeem a single stablecoin, subject to onboarding and other applicable law. The Final Rule also adds new § 15.12(f), which provides that the OCC will not require an issuer to redeem to the extent doing so would cause the issuer to violate other applicable law, such as the BSA or sanctions requirements.

Redemption Timeframe Extensions

The Proposal would have automatically extended the redemption period to seven calendar days if an issuer received redemption requests exceeding 10% of its outstanding issuance in a 24-hour period. The extension would have applied to all outstanding and subsequent requests, and an issuer could have redeemed sooner only if the OCC determined that it could do so in an orderly and fair manner.

Many commenters opposed the automatic extension, arguing that it would be pro-cyclical, could reinforce panic, and could contribute to de-pegging. Several recommended a discretionary approach, such as requiring notice to the OCC and OCC approval of any extension.

The Final Rule eliminates the automatic extension. Instead, it requires an issuer to notify the OCC within 24 hours if it receives redemption requests exceeding 10% of the outstanding issuance value of any brand of its payment stablecoins in a 24-hour period. The Final Rule permits the issuer to request an extension, and the OCC may grant or deny the request or impose discretionary limitations on redemption.

The OCC agreed with commenters that an automatic extension could prove pro-cyclical and trigger or exacerbate runs, but stated that prompt notice of a spike in redemptions is important because it may signal stress at the issuer. The OCC expects extensions to be rare.

Changes to Redemption Fees

Consistent with the GENIUS Act, the Proposal would have required an issuer to give at least seven calendar days’ prior notice of any change in purchase or redemption fees, including by securely delivering the notice to current customers.

The Final Rule retains the seven-calendar-day notice requirement but clarifies how notice is delivered. It requires notice to payment stablecoin holders, including by delivering the notice to customers with whom the issuer has a current relationship. The OCC explained that this change reflects the Final Rule’s narrower definition of “customer,” and that disclosures should reach holders who have not yet interacted directly with the issuer, while certain delivery requirements apply only to customers with a current relationship.

Risk Management, Reporting, and Supervision (Subpart B, §§ 15.13–15.16)

Risk Management

The GENIUS Act directs the OCC to adopt principles-based operational, compliance, and information technology risk management standards tailored to issuers’ business models and risk profiles. The Proposal implemented this mandate with a principles-based framework adapted from the OCC’s safety and soundness standards for national banks. Rather than prescribing specific metrics, it would have required issuers to maintain risk management appropriate to their size, complexity, and activities, covering areas such as internal controls, internal audit, interest rate risk, asset growth, earnings, insider and affiliate transactions, service providers, liquidity, and information security. Our earlier Legal Update discusses these standards in more detail.

The Final Rule retains this framework and adds new monetization and stress testing requirements that were not in the Proposal. The Final Rule requires an issuer to ensure that its reserve portfolio can support timely redemption under both normal and stressed conditions, including by analyzing a range of redemption scenarios. It also requires an issuer to maintain and demonstrate to the OCC the ability to access and monetize reserve assets, taking into account market access, financing channels, haircut assumptions, and operational readiness. Finally, the Final Rule requires regular stress testing of the reserve portfolio, including under significant positive interest rate scenarios.

Foreign Exchange Risk

The GENIUS Act’s definition of “payment stablecoin” refers to redemption for a fixed amount of “monetary value,” which the Act defines as a national currency or a deposit denominated in a national currency. In the preamble, the OCC stated that these definitions may reasonably be read to mean that payment stablecoins are not limited to those denominated in US dollars. The Final Rule’s text does not state this conclusion expressly, although its foreign exchange provisions assume it.

However, the eligible reserve asset list remains US-dollar- and US-government-based, so an issuer of a payment stablecoin denominated in a foreign currency must still back it with US dollar-denominated reserve assets. This could create foreign exchange risk if the dollar falls relative to the stablecoin’s currency.

The Final Rule addresses management of this risk. New § 15.10(a)(10) adds managing foreign exchange risk to the list of permitted activities. New § 15.13(a)(10) requires an issuer of a non-US-dollar payment stablecoin to hedge any residual foreign exchange risk identified through its stress testing so that it retains no more than minimal risk.

The Final Rule also prohibits the issuer from taking anticipatory or residual hedging positions, except as needed to establish or unwind a hedge, and from using foreign exchange risk management to speculate. It requires the issuer to maintain policies and procedures to manage foreign exchange risk and related risks, such as margin, counterparty, and basis risk. Finally, the Final Rule requires the issuer to give prior notice to the OCC and receive OCC approval before engaging in foreign exchange risk management, and to comply with any conditions the OCC imposes.

Affiliate and Insider Transactions

The GENIUS Act does not impose specific limits on transactions between an issuer and its affiliates or insiders. Instead, it directs the OCC to adopt principles-based risk management standards, and the OCC drew on its safety and soundness standards for national banks in addressing affiliate and insider transactions.

The Proposal did not import bank-style numerical limits such as those in Regulations O and W. It would have instead required that affiliate and insider transactions not be excessive or pose a significant risk of material financial loss, be on terms at least as favorable to the issuer as comparable third-party transactions, and be documented and reviewed by the board. It would also have required issuers to monitor and validate compliance.

The Final Rule retains these safeguards but replaces the prohibition on “excessive” transactions with a prohibition on transactions that are “quantitatively detrimental” to the issuer in light of its business model. Some commenters had asked the OCC to define “excessive.” The OCC explained that the degree of risk and potential loss associated with a transaction depends on the issuer’s business model, and that the revised standard provides greater specificity about the transactions prohibited. The OCC indicated that an issuer that conducts insider and affiliate transactions consistent with sections 22(g), 22(h), 23A, and 23B of the Federal Reserve Act and Regulations O and W is likely to satisfy the “quantitatively detrimental” standard.

The Final Rule also clarifies that these requirements apply to transactions alone and in the aggregate. Thus, a series of transactions may be inappropriate even if no single transaction would be, depending on the issuer’s business model. In our view, this is a material tightening of the standard.

Reporting and Audits

At a high level, the Proposal would have required confidential weekly reports to the OCC, public monthly reserve reports examined by a registered public accounting firm and certified by the CEO and CFO, and quarterly financial condition reports. Implementing the GENIUS Act, it also would have required issuers with more than $50 billion in outstanding issuance that are not companies that report to the Securities and Exchange Commission (“SEC”) to publish audited annual financial statements, and would have required an annual board certification of AML and sanctions compliance programs, with the first due within 180 days of approval. Our earlier Legal Update discusses these requirements in more detail.

The Final Rule largely retains this framework, with a few changes. The Final Rule requires that the $50 billion audit threshold be measured on a consolidated basis, consistent with the GENIUS Act. The OCC confirmed in the preamble that the audit requirement does not apply where the issuer’s operations are reflected in a qualifying parent company’s SEC reports. The Final Rule also limits the requirement to report on BSA and sanctions compliance upon request to FQPSIs that are nonbank entities, consistent with the statute.

The Final Rule still requires a PPSI’s board to provide the first AML and sanctions certification within 180 days of approval. Thereafter, however, the Final Rule permits the BSA officer, the board, or an appropriate board committee to provide the annual certification. The OCC explained that this balances active board oversight at the start of operations against the board’s ongoing administrative burden.

Examinations and Changes in Control

The Proposal would have required an annual full-scope examination of each PPSI, with an optional extended 18- to 36-month cycle for issuers that met certain criteria, including outstanding issuance below $1 billion or monthly trading volume below $25 billion. The Final Rule shortens the extended cycle to 18 to 24 months, drops the trading-volume test, and measures the $1 billion threshold together with any affiliated PPSIs, reflecting business models that use multiple SPV issuers. It also retains the requirement that persons acquiring control of a PPSI follow the change-in-control procedures in 12 C.F.R. 5.50 as if the PPSI were a national bank.

$10 Billion State PPSI Transition

The Final Rule retains the Proposal’s framework implementing section 4(d) of the GENIUS Act, under which a nonbank SQPSI that crosses $10 billion in outstanding issuance must notify the OCC within five calendar days and, within 360 days, either transition to OCC oversight or stop net new issuance until it falls below the threshold. The Final Rule clarifies that the threshold is measured on a consolidated, point-in-time basis and, in new § 15.15(e), allows a transitioned issuer to return to sole state supervision once the OCC determines that its consolidated issuance no longer exceeds $10 billion.

Final § 15.16(c) also lists the factors the OCC will consider in deciding whether “unusual and exigent circumstances” justify enforcement action against a nonbank SQPSI, such as an immediate risk to the issuer or the US financial system, the state regulator’s response, an actual or imminent inability to redeem on time, and significant secondary-market price fluctuations.

Privacy of Nonpublic Personal Information

The GENIUS Act does not establish a general privacy framework for PPSIs. It addresses nonpublic personal information directly in its restrictions on stablecoin issuance by certain non-financial public companies, which may issue only if they comply with limits on using, selling, or sharing nonpublic personal information obtained from stablecoin transaction data without consumer consent.

The Proposal would have required each issuer’s information security program to protect the security and confidentiality of customer nonpublic personal information. It would have defined that term to exclude publicly available information, including information on a distributed ledger, unless that information, when combined with other information, would reveal a customer’s identity or enable access to the customer’s account. Commenters argued that the definition was overbroad and asked the OCC to clarify that information recorded on a public blockchain is not nonpublic personal information.

The Final Rule revises the definition to exclude publicly available information, including information broadly accessible through a distributed ledger, and drops the “combined with other information” qualifier. In the preamble, the OCC explained that public wallet addresses would not be nonpublic personal information, while private information tying a customer’s identity to an address would be. The Final Rule also adds a definition of “sensitive customer information,” covering combinations of customer information that would reveal the customer’s identity or permit access to the customer’s account, and expressly extends the information security safeguards to that information.

Custody (Subpart C, §§ 15.20–15.23)

Section 10 of the GENIUS Act requires custodians of payment stablecoin reserves, stablecoins used as collateral, and private keys used to issue stablecoins to be subject to federal or state supervision, to treat these assets as customer property, and generally not to commingle them. The Proposal implemented section 10 through principles-based requirements in Subpart C, which would have applied to “covered assets” and required OCC-supervised custodians to separately account for and protect those assets from creditors’ claims. The Final Rule largely retains this approach but narrows the definition of “covered assets” in two ways. First, it applies only with respect to payment stablecoins offered, sold, or otherwise made available to persons in the United States, which the OCC explained reflects the presumption against extraterritorial application of US law.

Second, the Final Rule reaches stablecoins used as collateral only where the custodian has actual knowledge of that use. The OCC explained that commenters had noted that custodians may not know whether a stablecoin is being used as collateral, and that an actual-knowledge standard avoids burdensome due diligence. The Final Rule also expressly requires written custody agreements and requires custodians to separately record and account for covered assets.

The Proposal asked whether custodians should be permitted to commingle covered and non-covered assets in omnibus accounts, an issue our earlier Legal Update flagged. Commenters asked the OCC to confirm that established omnibus accounts at sub-custodians, which may commingle a custodian’s own assets with its customers’ assets, would not be disturbed. In response, new § 15.22(c) permits a custodian to hold its own assets and customers’ covered assets in the same omnibus account at a sub-custodian, provided the custodian maintains safeguards reasonably designed to ensure the sub-custodian keeps customer assets separate from its own property. The Final Rule also requires that the terms of omnibus accounts be disclosed and that adequate records be kept, and it expressly applies the consent-based control standard to private keys used to issue payment stablecoins.

The GENIUS Act excludes from section 10 a person that provides hardware or software to facilitate a customer’s own custody, and the Proposal mirrored that exclusion. In response to comments, the Final Rule adds conditions designed to prevent evasion. Under the Final Rule, the exclusion is available only if the provider neither controls nor holds itself out as controlling the relevant private keys and neither provides nor holds itself out as providing custody of covered assets.

Applications and Registrations (Subpart D, §§ 15.30–15.33)

PPSI Applications

The Proposal would have implemented the GENIUS Act’s application framework, under which the OCC must determine within 30 days whether an application is substantially complete and decide a substantially complete application within 120 days, failing which it is deemed approved.

The Final Rule retains this framework and adds several provisions. It permits the OCC to conditionally approve an application, which commenters had requested and which the OCC explained provides transparency about its authority to impose conditions. It also provides that the OCC will return without decision an application that remains incomplete 60 days after notice of missing information. Finally, the Final Rule adds as a review factor whether the applicant’s structure adequately addresses run risk and ensures its ability to redeem. The statutory decision period begins no earlier than the Act’s effective date, and separate bank charter or conversion approval remains necessary where applicable.

Section 4(a)(12) of the GENIUS Act restricts stablecoin issuance by public companies not predominantly engaged in financial activities, absent a unanimous finding by the Stablecoin Certification Review Committee. Our earlier Legal Update noted that the Proposal did not address these restrictions. The Final Rule requires applicants to certify whether those restrictions apply and, where applicable, to submit Corporate Background and Financial Reports. Approval may depend on the required Committee finding.

The GENIUS Act permits the OCC to waive the Act’s requirements for up to 12 months for issuers with applications pending on the Act’s effective date. The Proposal would have permitted waivers only of section 4 of the Act. Consistent with the statute, the Final Rule permits an issuer with a substantially complete application pending on or before January 18, 2027 to request a waiver of GENIUS Act or Part 15 requirements generally, for up to 12 months beginning on that date. The Final Rule permits the OCC to grant a waiver only if it finds that the waiver serves the public interest or is justified by extraordinary circumstances. Relief is discretionary, and the OCC may still deny the application.

OCC Application and Waiver Guidance

In guidance issued with the Final Rule, the OCC states that it generally expects to waive the prior-approval requirement for existing issuers operating in the United States with a substantially complete application pending by January 18, 2027, absent more compelling reasons to deny relief. According to the guidance, a pending application alone does not authorize continued issuance. The OCC states that it has not identified a generally applicable basis for waiving other GENIUS Act or Part 15 requirements or for waiving prior approval for issuers not yet operating in the United States. Under the guidance, any waiver remains discretionary and lasts only as long as necessary, subject to the 12-month statutory limit.

After the Office of Management and Budget approves the application forms, the OCC will announce when it will accept applications and waiver requests. Applicants should follow the process on the OCC’s GENIUS Act page and seek any waiver promptly. The guidance calls for detailed information on business plans and management, reserves and redemptions, capital and liquidity, shared services, BSA/AML and sanctions controls, third-party risk, and audit functions. The OCC generally plans to act on waiver requests by January 18, 2027. It will assess completeness within 30 days, review supplemental information within another 30 days, and may return an application that remains incomplete 60 days after its initial notice.

FPSI Registration

Under the GENIUS Act, an FPSI’s registration is deemed approved 30 days after the OCC receives it unless the OCC rejects it in writing. The Proposal implemented this process along with a revocation and rescission framework, and the Final Rule largely retains both. Mirroring the changes for domestic applicants, the Final Rule permits the OCC to conditionally approve a registration, adds run risk and redemption capacity as review factors, and requires an FPSI to certify whether Section 4(a)(12)’s restrictions apply.

Capital and Operational Backstop (Subpart E, §§ 15.40–15.42)

The GENIUS Act requires the OCC to adopt capital requirements tailored to issuers’ business models and risk profiles that do not exceed what is sufficient to ensure ongoing operations. The Proposal borrowed from bank capital rules and would have counted common equity tier 1 and additional tier 1 capital, including qualifying common stock, retained earnings, perpetual preferred stock, and accumulated other comprehensive income. Numerous commenters recommended deducting intangible assets and deferred tax assets because they have limited ability to absorb losses. The Final Rule instead defines capital based on US GAAP equity and requires deductions for goodwill, other intangibles, deferred tax assets, and the equity-funded portion of the required operational backstop. The OCC explained that the last deduction prevents the same funds from being counted twice.

The Proposal would have required a de novo issuer to hold an individualized minimum amount of capital set by the OCC, subject to a $5 million floor, during a generally three-year de novo period, after which the issuer would self-assess its capital needs. Under the Final Rule, the $5 million capital floor no longer ends after the de novo period. Although some commenters urged a more standardized approach, the Final Rule retains issuer-specific capital calibration, ongoing assessments, and OCC authority to impose additional requirements rather than adopting a standardized schedule of risk charges.

The Proposal would have required each issuer to maintain an operational backstop of highly liquid assets equal to 12 months of total expenses, separate from reserves, and would not have permitted debt to fund it. The Final Rule retains the 12-month requirement but permits qualifying subordinated debt to fund up to half of the backstop, subject to maturity and other safeguards. The OCC explained that debt funding is generally less expensive than equity, while the safeguards prevent the funding from disappearing suddenly. With OCC approval, the Final Rule permits issuers to exclude one-time costs wholly unrelated to continuing operations, and it requires issuers to count the historical expenses of an acquired issuer and the reasonable cost of shared affiliate services, even if the issuer does not reimburse the affiliate.

Under the Proposal, capital and backstop compliance would have been measured at quarter-end, with a prohibition on net new issuance after one failing quarter and mandatory redemption after two. Some commenters raised concerns that issuers could “window dress” quarter-end figures. In response, the Final Rule requires compliance at all times and notice to the OCC within 24 hours of a shortfall. The quarter-end issuance and liquidation triggers remain, and the Final Rule permits the OCC to accelerate issuance restrictions.

The Final Rule also addresses use of the backstop during a disruption. If an issuer uses backstop assets to address a temporary disruption or other operational event, the Final Rule treats the issuer as compliant while the backstop is below the required amount, provided the issuer notifies the OCC within 24 hours and submits within seven days a plan to restore the backstop within 90 days that the OCC deems viable. The OCC explained that this reflects the backstop’s purpose of supporting continued operations during such events.

The Proposal would have permitted uninsured national trust banks, including those that do not issue stablecoins, to elect Part 15 instead of Part 3 capital treatment by providing notice to the OCC. The Final Rule retains the election but requires prior OCC approval, and the OCC must decide within 60 days after receiving a complete request. The election covers the full capital and operational backstop framework. Rescission is effective when the OCC receives notice, and separately imposed capital requirements continue to apply.

Other Amendments

For bank parents, the Proposal would have required an insured national bank or federal savings association to deconsolidate a PPSI subsidiary for regulatory capital purposes and deduct the subsidiary’s retained earnings. The Final Rule retains this approach but also requires the bank to add back its share of the subsidiary’s losses. The OCC did not adopt a source-of-strength expectation or general bank liquidity relief. The amendments to Part 6 on prompt corrective action and Part 19 on enforcement are largely as proposed.

III. Rules for Non-US Issuers

Under section 18 of the GENIUS Act, an FPSI may offer payment stablecoins in the United States through digital asset service providers only if Treasury determines that its home regime is comparable, it registers with the OCC, it holds reserves at US financial institutions sufficient to meet US customers’ liquidity demands (absent a Treasury reciprocal arrangement), and its home country is not subject to comprehensive sanctions or designated as a primary money laundering concern. The Proposal implemented this pathway, and the Final Rule retains it. FPSIs cannot use the domestic pending-application safe harbor.

The Proposal restated the statutory requirement that an FPSI hold reserves at US financial institutions sufficient to meet US customer liquidity demands, but it did not specify how an FPSI would demonstrate compliance and would have defined a “United States customer” simply as a customer residing in the United States. Commenters asked the OCC to clarify both what constitutes a US customer and what reserves would be sufficient, and many opposed a fixed percentage requirement. In response, new § 15.31(a)(3) requires the reserves to be held at eligible financial institutions organized under US or state law and provides four ways to satisfy the requirement. The Final Rule also determines “United States customer” status at onboarding and defines the term to cover US-resident individuals, US-organized entities, and customers with a US principal place of business. Under the Final Rule, an FPSI may satisfy the reserve requirement by:

• Attesting that US-located holders hold less than 50% of outstanding issuance value and maintaining reserves at qualifying US institutions equal to at least 50% of outstanding issuance value;
• Holding substantially all reserves at qualifying US institutions and attesting to that fact;
• Ensuring on an ongoing basis that reserves at qualifying US institutions support timely US customer redemptions under normal and adverse conditions, with a buffer where necessary; or
• Obtaining prior written OCC approval of a detailed alternative proposal and complying with its conditions and limitations.

Under each alternative, the Final Rule permits an FPSI to withdraw excess localized reserves only after due diligence confirms that sufficient reserves will remain. Reporting is largely unchanged from the Proposal. The Final Rule provides that the OCC will conduct full-scope examinations of a registered FPSI at the same frequency as a PPSI unless it decides otherwise, and the OCC stated in the preamble that its supervisory role over FPSIs is not narrow or secondary.

Multi-Jurisdictional Issuance

The Proposal requested comment on an OCC-supervised issuer issuing or redeeming the same or similar stablecoins in other jurisdictions, including through foreign affiliates. Commenters asked for guidance or a safe harbor addressing reserve location and rebalancing, cross-border redemption, and coordination with foreign regulators. The Final Rule neither prohibits these arrangements nor creates a safe harbor or detailed framework. The OCC stated in the preamble that it will review structures case by case and coordinate with Treasury and foreign regulators before providing guidance.

In the preamble, the OCC stated that if reserves are rebalanced among affiliates, each PPSI must maintain identifiable reserves covering its own outstanding issuance at least 1:1 at all times and comply with the redemption and risk management requirements. The OCC also declined to allow a longer redemption timeframe for cross-border redemptions. An affiliate issuing the same token needs separate approval or registration, and Treasury determines whether a foreign regime is comparable and whether any reciprocal arrangement applies.

The Proposal would have applied the same affiliate-yield presumption to FPSIs as to PPSIs. Consistent with the change for US issuers, the Final Rule removes the presumption for FPSIs without relaxing the underlying statutory prohibition. The Final Rule requires an FPSI to redeem at par from any holder, subject to onboarding. Subpart E capital requirements do not automatically apply to an FPSI, although the OCC stated that it may impose conditions on registration where home-country rules or reciprocal arrangements are insufficient.

IV. Observations

The Final Rule retains the Proposal’s core requirements of full backing and timely redemption, even while providing issuers with greater flexibility in offering white-label arrangements and holders with greater flexibility for redemption. Issuers also have more flexibility in structuring reserves and distribution, alongside stress testing, tailored capital requirements, and OCC supervisory review.

Other issues remain for further rulemaking or guidance, including BSA/AML and sanctions standards, interoperability, multi-jurisdictional issuance, and capital equivalency deposits for federal branches. For foreign issuers, Treasury’s comparability determinations and any reciprocal arrangements will shape access to the US market.

With the January 18, 2027 effective date approaching, issuers should prepare applications, test their ability to meet redemptions under stress, and plan for capital and operational backstop funding. Existing US issuers seeking transitional relief need a substantially complete pending application and an affirmative waiver in advance of that deadline.

 

---

 

¹ There are several exclusions to this definition, including one for a “deposit” as defined in the Federal Deposit Insurance Act, “including a deposit recorded using distributed ledger technology.” The effect of this is to bring tokenized deposits outside the scope of the GENIUS Act, even if they function like payment stablecoins. This is important because the GENIUS Act does not permit insured depository institutions to issue “payment stablecoins” as defined in the GENIUS Act. This exclusion of tokenized deposits from the definition of “payment stablecoin” means that banks may still issue tokenized deposits that have functionality similar to payment stablecoins.